Details-Sign into Google account and go to:http://www.google.com/merchants/newfeedNow, Tick the box "I want to use Google Spreadsheet to store, edit and upload my feed" and Select 2nd option.It will ask us to enter the URL, type "javascript:alert(1)" without quotes and type "Click Me" in Doc's Title field.Click OK. Now click on "Click Me" and you will see a Pop-up due to XSS vulnerability.POC:

I reported this vulnerability to Google and I received below reply:

Hey,Due to the requirement for the victim to take a few actions, the panel has determined this bug didn't meet the threshold for a reward. Nonetheless, we'd like to acknowledge your assistance on our credit page (http://www.google.com/about/appsecurity/hall-of-fame/distinction/) under "Honorable Mention" - are you interested? If so, what name/link should we list?It should be of the form: name - site [site link]

I re-edited my URL :

http://www.google.com/merchants/newfeed?noCheck&verticalId=v:products&trixDocTitle=ClickMe&trixDocUrl=javascript:alert(1)Now, the victim has to only tick the "I want to use Google" option and click on "Click Me"To make it more easier, we could write something else in place of "Click Me" like:

Vulnerability Type: Privilege EscalationVulnerable Website: https://www.paypal-labs.comStatus:FixedVulnerability Overview: This vulnerability allowed an attacker to delete any user registered in paypal-labs.com.Details/Write-up: I forgot to take screenshots but I am sure my detail write-up will clear everything.